Politique de confidentialité

Effective date: May 1, 2026 Last updated: May 1, 2026

1. Who we are

This Privacy Policy explains how DiPuglia LTD, an Ontario corporation doing business as Clavia (“Clavia,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit clavia.ca (the “Site”), make a purchase, contact us, or otherwise interact with our business.

Clavia operates only within Canada. We comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, with Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) and the Civil Code of Quebec.

This Privacy Policy works alongside our Terms and Conditions and our Shipping Policy. If anything in those documents touches on personal information, this Policy controls.

2. Our Privacy Officer

In accordance with PIPEDA section 4.1.1 and Quebec Law 25, we have designated a Privacy Officer who is responsible for our compliance with this Policy and with applicable privacy law.

You can write to the Privacy Officer with any question, concern, or request related to your personal information.

3. What information we collect

We collect only what we need to run the Site, process orders, and meet our legal obligations. The categories of personal information we collect are:

3.1 Information you give us directly

•          Account information: name, email address, password (stored as a salted hash, not in plain text).

•          Order information: billing name and address, shipping name and address, phone number, the items you ordered, order history.

•          Payment information: payment method, last four digits of your card or other tokenized identifier returned by our payment processor. We do not collect or store full credit card numbers, CVV codes, or full bank account numbers.

•          Communications: the content of emails, chat messages, product reviews, contact form submissions, and any attachments you send us.

•          Marketing preferences: your subscription status for emails, SMS, and other channels you opt into.

3.2 Information collected automatically when you use the Site

•          Device and browser data: browser type and version, operating system, screen size, language, time zone.

•          Usage data: pages viewed, products viewed, time on page, referring URL, search terms used on the Site, items added to cart, abandoned carts.

•          Network data: your Internet Protocol (IP) address (which can identify your approximate city or region), session identifiers.

•          Cookies and similar technologies: see Section 11.

3.3 Information we receive from third parties

•          Payment processors (for example, Shopify Payments, Stripe, PayPal): payment authorization results, fraud risk signals, the last four digits of cards.

•          Shipping carriers: delivery status, exceptions, signature confirmations.

•          Fraud-prevention partners: risk scores tied to your order or device.

•          Analytics and advertising platforms: aggregated audience data, conversion signals tied to a campaign.

We do not buy lists of personal contact information, and we do not enrich your profile with data scraped from social media.

4. Why we collect this information

We collect personal information for the following purposes and no others:

•          To create and manage your account.

•          To accept your order, process payment, and ship the products.

•          To send you order confirmations, shipping notifications, return updates, and warranty-related communications (these are transactional and not optional once you place an order).

•          To handle returns, refunds, exchanges, and warranty claims.

•          To provide customer service and respond to your questions.

•          To detect, prevent, and investigate fraud, chargebacks, and security incidents.

•          To improve the Site, the product range — from cameras and projectors to bone conduction headphones — the checkout experience, and our service.

•          With your consent: to send marketing emails, promotional SMS, and behavioural advertising (you can withdraw consent at any time).

•          To comply with our legal and tax obligations (for example, record-keeping under the Income Tax Act and the Excise Tax Act).

•          To establish, exercise, or defend legal claims.

We will not use your personal information for any new purpose without informing you and, where required, obtaining fresh consent.

5. The legal basis for processing

Under PIPEDA, we rely on your consent — which may be express or, where appropriate and reasonable for the purpose, implied. Under Quebec Law 25, consent must be given for specific purposes, in a clear and informed way, separately from other terms.

You give us express consent when you check a marketing opt-in box, click “I agree” on a separate banner, or otherwise affirm a specific purpose.

We rely on implied consent only for processing that is necessary to deliver something you asked for — for example, using your shipping address to deliver an order you placed.

You can withdraw consent at any time for non-essential processing by writing to our Privacy Officer (Section 2). Withdrawing consent may affect our ability to provide certain services — for example, if you withdraw consent to process payment information, we cannot complete future purchases.

6. Who we share personal information with

We share personal information only when necessary, and only with the categories of recipients below.

Recipient category	Why we share	Example
Payment processors	To authorize and settle your payment	Shopify Payments, Stripe
Shipping carriers	To deliver your order and provide tracking	Canada Post, Purolator, FedEx Canada
Warehouse and fulfillment partners	To pick, pack, and ship your order from our Canadian warehouses	Randmar Inc., operating four Canadian warehouses
Customer service tools	To answer your questions and manage tickets	Specific vendor available on request from the Privacy Officer
Email and marketing platforms	To send order emails and (with consent) marketing	Specific vendor available on request from the Privacy Officer
Analytics providers	To understand how the Site is used in aggregate	Google Analytics, Shopify Analytics
Tax and accounting professionals	To meet our tax and accounting obligations	Our external accountant
Legal advisors	To protect our legal rights and respond to legal requests	Our external counsel
Government and regulators	When required by law, court order, or to protect safety	Canada Revenue Agency, law enforcement
A buyer or successor entity	If Clavia is sold, merged, or reorganized	A buyer in an asset purchase

We require service providers to handle personal information under written contracts, to use it only for the purposes we instruct, and to protect it with security measures consistent with this Policy.

We do not sell your personal information. We do not rent your contact information. We do not share your personal information with data brokers.

7. Where your personal information is stored and processed

The Site runs on Shopify, whose servers and infrastructure may be located in Canada, the United States, the European Union, or other countries where Shopify operates. Other service providers listed in Section 6 may also store data outside Canada, principally in the United States.

When personal information is transferred outside Quebec or Canada, it becomes subject to the laws of the destination country, which may not provide the same level of protection as Canadian law. By using the Site, you acknowledge this cross-border transfer.

We have completed, or will complete before each new transfer, a privacy impact assessment as required by Law 25 section 17 for the disclosure of personal information outside Quebec.

8. How long we keep personal information

We keep personal information only as long as we need it for the purposes described in this Policy, or as required by law.

Type of information	Retention period
Account information	While your account is active, plus 24 months of inactivity, after which we delete or anonymize it
Order and transaction records	7 years from the order date (required under federal tax legislation)
Marketing consents and unsubscribe records	Until you unsubscribe, plus the minimum period needed to prove compliance under Canada’s Anti-Spam Legislation
Customer service correspondence	3 years from the date of the last message
Website analytics data	26 months in identifiable form, then aggregated
Cookies	See Section 11 — varies by cookie

When we no longer need personal information for any legitimate purpose, we either delete it securely or render it anonymous.

9. How we protect personal information

We use organizational, technical, and physical safeguards appropriate to the sensitivity of the information, including:

•          Encryption in transit using TLS for all Site traffic.

•          Encryption at rest for payment data handled by our PCI-DSS-compliant payment processors.

•          Access controls — only employees and contractors who need access to personal information for their role have it.

•          Password hashing with industry-standard algorithms.

•          Logging and monitoring of access to administrative systems.

•          Annual review of our privacy and security practices.

•          Confidentiality clauses in contracts with every service provider and contractor.

No system is perfectly secure. If a privacy incident affects your personal information and creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA, and the Commission d’accès à l’information du Québec if Quebec residents are affected — as soon as feasible after we become aware of the incident.

10. Your rights

Subject to applicable law, you have the following rights with respect to your personal information.

10.1 Right to access

You may request a copy of the personal information we hold about you, and information about how it is used and to whom it is disclosed.

10.2 Right to correction

You may ask us to correct personal information that is inaccurate, incomplete, or out of date.

10.3 Right to withdraw consent

You may withdraw consent to non-essential processing at any time. This will not affect the lawfulness of processing carried out before withdrawal.

10.4 Right to data portability (Quebec residents)

If you are a Quebec resident, you have the right to receive computerized personal information you provided to us in a structured, commonly used technological format, and to ask us to transmit it directly to another organization where technically feasible. This right takes effect under Law 25 section 27.

10.5 Right to deletion and de-indexing (Quebec residents)

If you are a Quebec resident, you may ask us to stop disseminating personal information about you, or to deindex any hyperlink that allows access to that information, where the dissemination contravenes the law or a court order, or where the information causes you serious injury that outweighs the public interest.

10.6 Right to information about automated decisions (Quebec residents)

If we use a personal information system to make a decision about you based exclusively on automated processing, we will inform you at or before the decision, and on request will explain the personal information used, the reasons and main factors that led to the decision, and your right to have the decision reviewed by a human.

10.7 How to exercise your rights

Write to the Privacy Officer using the contact information in Section 2. We will respond within 30 days of receiving a valid request. We may ask you to verify your identity before acting on the request, and we may charge a reasonable fee for transcription, reproduction, or transmission costs only where the law allows — we will tell you the fee in advance.

If you are not satisfied with our response, you have the right to file a complaint with:

•          The Office of the Privacy Commissioner of Canada (priv.gc.ca) for federal PIPEDA matters.

•          The Commission d’accès à l’information du Québec (cai.gouv.qc.ca) if you are a Quebec resident.

11. Cookies and similar technologies

A cookie is a small text file stored on your device. We use cookies and similar technologies (pixels, local storage, SDKs) for the following purposes.

Category	Purpose	Can you turn it off?
Strictly necessary	Keep you logged in, hold items in your cart, prevent fraud	No — the Site does not work without these
Functional	Remember your language, currency, and display preferences	Yes — through your browser, but the Site may behave less well
Analytics	Understand how the Site is used, in aggregate	Yes — through the cookie banner
Marketing and retargeting	Show you Clavia ads on other sites and measure ad performance	Yes — through the cookie banner

When you first visit the Site, we ask for your consent to non-essential cookies through a cookie banner. You can change your choices any time by clicking the cookie settings link in the Site footer.

We honour the Global Privacy Control (GPC) signal where your browser sends it: if we detect GPC, we treat it as a request to opt out of non-essential tracking.

12. Marketing communications

We will send you marketing emails or SMS only if you have given us express consent, in accordance with Canada’s Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link, and every marketing SMS includes a “STOP” keyword to opt out. We process unsubscribes within 10 business days, as required by CASL.

Transactional messages (order confirmations, shipping updates, warranty correspondence, security alerts) are not marketing and continue while you have an account or open order.

13. Children’s information

The Site is intended for adults of legal age in their province or territory of residence. We do not knowingly collect personal information from anyone under the age of 14 (the Quebec threshold under Law 25 for consent to processing of personal information without parental authorization). If you believe a child has provided us with personal information, write to our Privacy Officer and we will delete it.

14. Automated decision-making

We use automated tools to detect fraud risk on orders and to recommend products in some parts of the Site. These tools may flag an order for human review but do not by themselves block, cancel, or refund an order — a member of our team makes the final decision.

If this changes — for example, if we begin to use a fully automated system to refuse orders — we will update this Policy, notify affected users in advance, and offer the rights described in Section 10.6.

15. Confidentiality incident register

In accordance with Law 25, we maintain a register of confidentiality incidents involving personal information, including the description of the incident, the circumstances, the personal information concerned, and the measures we took in response. The register is available to the Commission d’accès à l’information on request.

16. Changes to this Policy

We may update this Policy from time to time. When we do, we will post the updated version on this page with a new “Last updated” date. Material changes will be highlighted at the top of the page for at least 30 days, and where the law requires, we will obtain fresh consent before applying the change to existing personal information.

The version of the Policy that applies to any given interaction is the version posted at the time of that interaction.

17. Contact us about privacy

For any question about this Policy, to exercise a right under Section 10, or to file a complaint:

Email: privacy@clavia.ca Mailing address: 343 Preston Street, 11th floor, Ottawa, Ontario, K1S 1N4

For Quebec residents, the French-language version of this Policy is available at /fr/policies/privacy-policy. The French version is the official version for Quebec residents.

End of Privacy Policy — version 1.3.